claude-code-session-manager 0.80.0 → 0.82.0

package/src/main/__tests__/scheduler-looks-done.test.cjs

@@ -33,7 +33,7 @@ const { execFileSync } = require('node:child_process');
 const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'looks-done-test-'));
 process.env.HOME = tmpHome;
 
-const { reverifyNeedsReview, computeLooksDone } = require('../scheduler.cjs');
+const { reverifyNeedsReview, computeLooksDone, findSatisfyingCommitOnMain } = require('../scheduler.cjs');
 const { resolvePrdWriteDir } = require('../lib/prdLocations.cjs');
 const { bustCwdCache } = require('../lib/queueStore.cjs');
 
@@ -51,6 +51,18 @@ function initRepo(dir) {
   git(['commit', '-q', '-m', 'initial'], dir);
 }
 
+// -b main pins the branch name regardless of the host's init.defaultBranch
+// config — findSatisfyingCommitOnMain's tests need a deterministic 'main' ref.
+function initRepoOnMain(dir) {
+  fs.mkdirSync(dir, { recursive: true });
+  git(['init', '-q', '-b', 'main'], dir);
+  git(['config', 'user.email', 'test@example.com'], dir);
+  git(['config', 'user.name', 'Test'], dir);
+  fs.writeFileSync(path.join(dir, 'README.md'), 'hello\n', 'utf8');
+  git(['add', '-A'], dir);
+  git(['commit', '-q', '-m', 'initial'], dir);
+}
+
 function commitFile(dir, relPath, content, message) {
   const abs = path.join(dir, relPath);
   fs.mkdirSync(path.dirname(abs), { recursive: true });
@@ -228,6 +240,134 @@ test('computeLooksDone: no declared paths on the PRD → null, never fabricates
   assert.equal(looksDone, null);
 });
 
+test('needs_review row with autoFixAttempted:true is never also stamped looksDone (PRD 1136 — mutually exclusive)', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-already-fix-planned');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd, 'proj-already-fix-planned-slug');
+  writePrd(projectCwd, '30-example', [
+    '# Implementation notes',
+    'Edit `src/thing.js`.',
+  ].join('\n'));
+
+  // startedAt/finishedAt are fixed well in the past so the real-time commit
+  // below lands outside committedInWindow's [startedAt, finishedAt+60s]
+  // window — otherwise the pre-existing heal pass would auto-complete the
+  // row before ever reaching the stillOpen/looksDone branch this test
+  // targets (committedInWindow, unlike computeLooksDone's landedSinceRun,
+  // has no upper bound skip).
+  const startedAt = '2020-01-01T00:00:00.000Z';
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: '30-example',
+      status: 'needs_review',
+      cwd: projectCwd,
+      runId: 'run-30',
+      startedAt,
+      finishedAt: '2020-01-01T00:05:00.000Z',
+      verifierVerdict: 'transcript_errors',
+      error: 'transcript_errors: stale verdict',
+      // A fix-plan child was already minted for this row at finalize time —
+      // the exact ordering that always precedes a later reverifyNeedsReview
+      // pass, since autoFixAttempted is stamped synchronously in the same
+      // mutate() as the needs_review transition itself.
+      autoFixAttempted: true,
+    },
+  ]);
+  writeRunLog('run-30', '30-example', [
+    '[scheduler] starting 30-example',
+    JSON.stringify({ type: 'result', subtype: 'error_during_execution', is_error: true, result: 'still broken' }),
+  ]);
+
+  commitFile(projectCwd, 'src/thing.js', 'hello', 'later commit touching the declared path');
+
+  await reverifyNeedsReview();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  assert.equal(jobs.length, 1);
+  assert.equal(jobs[0].status, 'needs_review');
+  assert.equal(jobs[0].looksDone, undefined, 'a row already fix-planned must never also be stamped looksDone');
+  assert.equal(jobs[0].error, 'transcript_errors: stale verdict', 'the looksDone annotation must not overwrite the original error');
+});
+
+// findSatisfyingCommitOnMain — PRD 1136's already-satisfied-on-main evidence
+// query. Requires EVERY declared path to have landed on main since
+// queuedAt, not just one — a code-review finding (2026-09-07) confirmed
+// that a PRD citing both its real target file and a second file purely as
+// context (e.g. a `path/to/file.js:123` reference) would otherwise
+// auto-complete unattended off any unrelated commit touching only that
+// second, incidental file.
+
+test('findSatisfyingCommitOnMain: single declared path, satisfying commit lands on main → returns the sha', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-satisfied-single-path');
+  initRepoOnMain(projectCwd);
+  registerActiveProject(projectCwd, 'proj-satisfied-single-path-slug');
+  writePrd(projectCwd, '40-single-path', [
+    '# Implementation notes',
+    'Edit `src/real-work.js`.',
+  ].join('\n'));
+
+  const queuedAt = new Date().toISOString();
+  await wait(1100);
+  commitFile(projectCwd, 'src/real-work.js', 'hello', 'fix real-work');
+
+  const job = { slug: '40-single-path', cwd: projectCwd, queuedAt };
+  const commits = await findSatisfyingCommitOnMain(job);
+  assert.equal(commits.length, 1);
+});
+
+test('findSatisfyingCommitOnMain: two declared paths but only ONE lands → [] (not satisfied — no false completion off an incidental context citation)', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-satisfied-partial-path');
+  initRepoOnMain(projectCwd);
+  registerActiveProject(projectCwd, 'proj-satisfied-partial-path-slug');
+  writePrd(projectCwd, '41-partial-path', [
+    '# Implementation notes',
+    'Edit `src/real-work.js`. See `src/main/hotfile.js:123` for context.',
+  ].join('\n'));
+
+  const queuedAt = new Date().toISOString();
+  await wait(1100);
+  // Only the incidentally-cited context file gets a later, UNRELATED commit
+  // — the actual target path (src/real-work.js) never lands.
+  commitFile(projectCwd, 'src/main/hotfile.js', 'unrelated change', 'unrelated commit');
+
+  const job = { slug: '41-partial-path', cwd: projectCwd, queuedAt };
+  const commits = await findSatisfyingCommitOnMain(job);
+  assert.deepEqual(commits, [], 'partial path coverage must never be treated as satisfied');
+});
+
+test('findSatisfyingCommitOnMain: two declared paths, BOTH land → returns satisfying commits', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-satisfied-both-paths');
+  initRepoOnMain(projectCwd);
+  registerActiveProject(projectCwd, 'proj-satisfied-both-paths-slug');
+  writePrd(projectCwd, '42-both-paths', [
+    '# Implementation notes',
+    'Edit `src/real-work.js` and `src/main/hotfile.js`.',
+  ].join('\n'));
+
+  const queuedAt = new Date().toISOString();
+  await wait(1100);
+  commitFile(projectCwd, 'src/real-work.js', 'hello', 'fix real-work');
+  commitFile(projectCwd, 'src/main/hotfile.js', 'hello', 'fix hotfile too');
+
+  const job = { slug: '42-both-paths', cwd: projectCwd, queuedAt };
+  const commits = await findSatisfyingCommitOnMain(job);
+  assert.ok(commits.length >= 1, 'full path coverage must be treated as satisfied');
+});
+
+test('findSatisfyingCommitOnMain: no queuedAt on the job → [] without querying git', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-no-queued-at');
+  initRepoOnMain(projectCwd);
+  registerActiveProject(projectCwd, 'proj-no-queued-at-slug');
+  writePrd(projectCwd, '43-no-queued-at', [
+    '# Implementation notes',
+    'Edit `src/thing.js`.',
+  ].join('\n'));
+
+  const job = { slug: '43-no-queued-at', cwd: projectCwd };
+  const commits = await findSatisfyingCommitOnMain(job);
+  assert.deepEqual(commits, []);
+});
+
 test('computeLooksDone: non-git cwd → null without throwing (git-unavailable)', async () => {
   const notARepo = fs.mkdtempSync(path.join(tmpHome, 'not-a-repo-'));
   writePrd(notARepo, '11-no-repo', [

package/src/main/__tests__/scheduler-periodic-reverify-guard.test.cjs

@@ -0,0 +1,85 @@
+/**
+ * scheduler-periodic-reverify-guard.test.cjs
+ *
+ * The 10-minute periodic tick cheap-guards reverifyNeedsReview() so the log
+ * scan only runs when the queue actually holds something rescannable. That
+ * guard was hand-written as `jobs.some(j => j.status === 'needs_review')`
+ * while PRD 1102 widened isRescanCandidate to also accept an unverified-
+ * shaped `failed` row — so reverifyNeedsReview's failed → needs_review
+ * looksDone branch was unreachable from the periodic path on any queue with
+ * zero needs_review rows. A failed row with no run log stayed wedged for five
+ * days (reported 2026-09-10 from social-signals-trader); only an app restart,
+ * via the unguarded boot call, could reach it.
+ *
+ * These tests pin the guard to isRescanCandidate so the two cannot drift again.
+ *
+ * HOME is overridden to a tmp dir BEFORE requiring scheduler.cjs — see
+ * scheduler-reap-dead-running-jobs.test.cjs's comment for why.
+ *
+ * Run: timeout 180 npx vitest run src/main/__tests__/scheduler-periodic-reverify-guard.test.cjs
+ */
+
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'reverify-guard-test-'));
+process.env.HOME = tmpHome;
+
+const { shouldRunPeriodicReverify, isRescanCandidate } = require('../scheduler.cjs');
+
+function writeRunLog(runId, slug, lines) {
+  const runDir = path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', runId);
+  fs.mkdirSync(runDir, { recursive: true });
+  fs.writeFileSync(path.join(runDir, `${slug}.log`), lines.join('\n') + '\n');
+}
+
+test('a lone unverified-shaped failed row (no needs_review sibling) fires the periodic pass', () => {
+  writeRunLog('run-guard-1', '4056-outcome-stats', ['[scheduler] starting 4056-outcome-stats']); // no result event
+  const jobs = [
+    { slug: '4059-chores-status', status: 'running', runId: 'run-guard-running' },
+    {
+      slug: '4056-outcome-stats',
+      status: 'failed',
+      runId: 'run-guard-1',
+      error: 'reaped: no runtime.pid recorded after 10m — spawn never completed (outcome=no_result)',
+    },
+  ];
+  assert.equal(isRescanCandidate(jobs[1]), true, 'fixture must be a genuine rescan candidate');
+  assert.equal(shouldRunPeriodicReverify(jobs), true);
+});
+
+test('a failed row with a real result event (genuine red gate) does NOT fire the pass', () => {
+  writeRunLog('run-guard-2', '200-red', [
+    '[scheduler] starting 200-red',
+    JSON.stringify({ type: 'result', subtype: 'success', is_error: true }),
+  ]);
+  const jobs = [{ slug: '200-red', status: 'failed', runId: 'run-guard-2' }];
+  assert.equal(isRescanCandidate(jobs[0]), false);
+  assert.equal(shouldRunPeriodicReverify(jobs), false);
+});
+
+test('needs_review with a rescannable verdict still fires; a non-rescannable verdict does not', () => {
+  writeRunLog('run-guard-3', '300-nr', ['[scheduler] starting 300-nr']);
+  assert.equal(
+    shouldRunPeriodicReverify([
+      { slug: '300-nr', status: 'needs_review', runId: 'run-guard-3', verifierVerdict: 'verify_unavailable' },
+    ]),
+    true,
+  );
+  assert.equal(
+    shouldRunPeriodicReverify([
+      { slug: '300-nr', status: 'needs_review', runId: 'run-guard-3', verifierVerdict: 'uncommitted_changes' },
+    ]),
+    false,
+  );
+});
+
+test('a queue with nothing rescannable, or a non-array, does not fire the pass', () => {
+  assert.equal(shouldRunPeriodicReverify([{ slug: 'a', status: 'pending' }, { slug: 'b', status: 'completed' }]), false);
+  assert.equal(shouldRunPeriodicReverify([]), false);
+  assert.equal(shouldRunPeriodicReverify(undefined), false);
+});

package/src/main/__tests__/scheduler-rate-limit-pause.test.cjs

@@ -0,0 +1,81 @@
+/**
+ * scheduler-rate-limit-pause.test.cjs — PRD 1118: pause against the BINDING
+ * rate-limit window read off a run's own log, not refreshNextReset()'s
+ * five_hour-only assumption, and never leave an indefinite pause with no
+ * resume timer when both the log and the billing endpoint come up empty
+ * (the live failure mode: the usage endpoint itself 429s).
+ *
+ * These test the PURE decision functions scheduler.cjs's setPaused() and the
+ * spawnJob() rateLimited branch delegate to — never the real setPaused/mutate
+ * path, which writes the machine's live scheduler queue.json at a fixed
+ * homedir path (~/.claude/session-manager/scheduled-plans) and must not be
+ * touched by a test run.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-rate-limit-pause.test.cjs
+ */
+
+'use strict';
+
+import { test } from 'vitest';
+const assert = require('node:assert/strict');
+const path = require('node:path');
+const {
+  resolveRateLimitPauseReset,
+  computeEffectiveResumeAt,
+  computeResumeDelay,
+} = require('../scheduler.cjs');
+
+// Repo-tracked, byte-for-byte copy of the real 2026-09-05 starry-night-ships
+// incident log (see src/main/lib/__tests__/rateLimitWindow.test.cjs for the
+// live-path parity check) — kept hermetic rather than pointed at the
+// machine-local live path directly.
+const FIXTURE = path.join(__dirname, '..', 'lib', '__tests__', 'fixtures', '204-mercury-steam-horse.log.txt');
+const FIVE_HOUR_ISO = new Date(1788643800 * 1000).toISOString(); // what refreshNextReset() would have returned
+const SEVEN_DAY_ISO = new Date(1789059600 * 1000).toISOString(); // the actually-binding window
+
+test('resolveRateLimitPauseReset: prefers the log-derived seven-day reset over the billing five_hour reset', () => {
+  const resetIso = resolveRateLimitPauseReset(FIXTURE, FIVE_HOUR_ISO);
+  assert.strictEqual(resetIso, SEVEN_DAY_ISO);
+  assert.notStrictEqual(resetIso, FIVE_HOUR_ISO);
+});
+
+test('resolveRateLimitPauseReset: falls back to the billing reset when the log yields none', () => {
+  const resetIso = resolveRateLimitPauseReset('/nonexistent/path/job.log', FIVE_HOUR_ISO);
+  assert.strictEqual(resetIso, FIVE_HOUR_ISO);
+});
+
+test('resolveRateLimitPauseReset: null when BOTH the log and the billing endpoint are unavailable', () => {
+  assert.strictEqual(resolveRateLimitPauseReset('/nonexistent/path/job.log', null), null);
+});
+
+test('computeEffectiveResumeAt: rate_limit with no resumeAt gets the same bounded 30-minute fallback as network', () => {
+  const now = Date.parse('2026-09-05T16:32:00.000Z');
+  const resumeAt = computeEffectiveResumeAt('rate_limit', null, now);
+  assert.strictEqual(resumeAt, new Date(now + 30 * 60_000).toISOString());
+});
+
+test('computeEffectiveResumeAt: an explicit resumeAt (the log-derived reset) is never overridden', () => {
+  const resumeAt = computeEffectiveResumeAt('rate_limit', SEVEN_DAY_ISO, Date.now());
+  assert.strictEqual(resumeAt, SEVEN_DAY_ISO);
+});
+
+test('computeEffectiveResumeAt: other reasons (e.g. auth) get no fallback — stays indefinite', () => {
+  assert.strictEqual(computeEffectiveResumeAt('auth', null, Date.now()), null);
+});
+
+test('computeResumeDelay: a seven-day-out reset (~5 days from now) is armed, not treated as too-far', () => {
+  const now = Date.parse('2026-09-05T16:32:00.000Z');
+  // ~5 days out — comfortably under the 0x7fffffff (~24.8 day) setTimeout cap.
+  const fiveDaysOut = new Date(now + 5 * 24 * 60 * 60_000).toISOString();
+  const { delayMs, tooFar } = computeResumeDelay(fiveDaysOut, now);
+  assert.strictEqual(tooFar, false);
+  assert.ok(delayMs < 0x7fffffff, `expected delay under setTimeout cap, got ${delayMs}`);
+  assert.ok(delayMs > 400_000_000, `expected ~5 days in ms, got ${delayMs}`);
+});
+
+test('computeResumeDelay: a reset far enough out DOES trip the overflow guard', () => {
+  const now = Date.parse('2026-09-05T16:32:00.000Z');
+  const thirtyDaysOut = new Date(now + 30 * 24 * 60 * 60_000).toISOString();
+  const { tooFar } = computeResumeDelay(thirtyDaysOut, now);
+  assert.strictEqual(tooFar, true);
+});

package/src/main/__tests__/scheduler-reap-dead-running-jobs.test.cjs

@@ -223,7 +223,11 @@ test('reapDeadRunningJobs salvages a delta-scoped in-place patch (PRD 1098) when
 
   const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
   const row = jobs.find((j) => j.slug === 'vanished-inplace');
-  assert.equal(row.status, 'completed');
+  // PRD 1133: a successful-looking reap that left everything uncommitted
+  // (no branch, HEAD never moved) must never read as 'completed' — this is
+  // exactly the dangerous shape the reaper now proves against.
+  assert.equal(row.status, 'needs_review');
+  assert.equal(row.verifierVerdict, 'reaped_without_integration');
   assert.ok(row.salvagePatch, 'a salvage patch must be recorded on the row');
   assert.ok(fs.existsSync(row.salvagePatch));
   const patch = fs.readFileSync(row.salvagePatch, 'utf8');
@@ -332,8 +336,207 @@ test('reapDeadRunningJobs skips in-place salvage (no whole-tree dump) when the r
 
   const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
   const row = jobs.find((j) => j.slug === 'vanished-no-baseline');
-  assert.equal(row.status, 'completed');
+  // PRD 1133: no commit landed (HEAD never moved) — must not read as 'completed'
+  // just because the log's own result event looked clean.
+  assert.equal(row.status, 'needs_review');
+  assert.equal(row.verifierVerdict, 'reaped_without_integration');
   assert.equal(row.salvagePatch, undefined, 'must skip salvage entirely rather than ever dumping the whole tree');
   assert.equal(row.leftoverPaths, undefined, 'no baseline means no safe attribution — must not guess');
   assert.equal(row.leftoverCount, undefined);
 });
+
+// ---------- PRD 1133: reaper must prove integration before 'completed' ----------
+
+test('reapDeadRunningJobs: a worktree job shaped like PRD 1118 (branch un-integrated, landedCommit absent) comes out needs_review, naming the branch, and never merges it', async () => {
+  const projectCwd = path.join(tmpHome, 'i-project-1118-shape');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  const headBefore = git(['rev-parse', 'HEAD'], projectCwd).trim();
+  const slug = '1118-pause-until-the-binding-rate-limit-window';
+  const branch = `sm-job/${slug}`;
+  // Simulate the job's own worktree branch: one real commit, never merged
+  // back into the main tree (exactly the live 1118 shape — "one real commit,
+  // +301", stranded on sm-job/1118-... with landedCommit undefined).
+  git(['checkout', '-b', branch], projectCwd);
+  fs.writeFileSync(path.join(projectCwd, 'rateLimitWindow.cjs'), 'module.exports = {};\n', 'utf8');
+  git(['add', '-A'], projectCwd);
+  git(['commit', '-q', '-m', 'add rateLimitWindow.cjs'], projectCwd);
+  // Back to the original tip (detached is fine — reap only reads guardCwd's
+  // current HEAD, it never needs a named branch checked out).
+  git(['checkout', headBefore], projectCwd);
+
+  const runId = `run-${slug}`;
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug,
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 }, // guaranteed-dead pid
+      guardHeadBefore: headBefore,
+      startedAt: new Date(Date.now() - 60_000).toISOString(),
+    },
+  ]);
+  writeRunLog(runId, slug, ['{"type":"result","subtype":"success","result":"done","is_error":false}']);
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === slug);
+  assert.equal(row.status, 'needs_review', 'a successful-looking result event must not be enough on its own');
+  assert.equal(row.verifierVerdict, 'reaped_without_integration');
+  assert.match(row.error, new RegExp(branch.replace('/', '\\/')), 'the parked reason must name the branch that still holds the work');
+  assert.equal(row.landedCommit, undefined, 'nothing was actually merged, so landedCommit must stay unset');
+
+  // The branch itself must survive untouched — this reap must never attempt
+  // (let alone perform) the merge.
+  const branchStillExists = git(['rev-parse', '--verify', branch], projectCwd).trim();
+  assert.ok(branchStillExists, 'the un-integrated branch must be preserved, not merged or deleted, by a mere reap');
+  assert.equal(git(['rev-parse', 'HEAD'], projectCwd).trim(), headBefore, 'guardCwd HEAD must not have moved — no merge was performed');
+});
+
+test('reapDeadRunningJobs: a worktree job whose branch is already fully integrated into HEAD comes out completed, with landedCommit stamped', async () => {
+  const projectCwd = path.join(tmpHome, 'j-project-real-success');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  const headBefore = git(['rev-parse', 'HEAD'], projectCwd).trim();
+  const slug = 'real-successful-worktree-run';
+  const branch = `sm-job/${slug}`;
+  git(['checkout', '-b', branch], projectCwd);
+  fs.writeFileSync(path.join(projectCwd, 'feature.txt'), 'shipped\n', 'utf8');
+  git(['add', '-A'], projectCwd);
+  git(['commit', '-q', '-m', 'ship feature'], projectCwd);
+  git(['checkout', headBefore], projectCwd); // back to the pre-branch tip (detached)
+  // Simulate a normal completion pass having already integrated the branch
+  // (integrateJobBranch's own fast-forward path) BEFORE the process vanished
+  // between that merge and the queue write landing.
+  git(['merge', '--ff-only', branch], projectCwd);
+  const headAfterMerge = git(['rev-parse', 'HEAD'], projectCwd).trim();
+
+  const runId = `run-${slug}`;
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug,
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 },
+      guardHeadBefore: headBefore,
+      startedAt: new Date(Date.now() - 60_000).toISOString(),
+    },
+  ]);
+  writeRunLog(runId, slug, ['{"type":"result","subtype":"success","result":"done","is_error":false}']);
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === slug);
+  assert.equal(row.status, 'completed', 'the branch is already an ancestor of HEAD — the work genuinely landed');
+  assert.equal(row.verifierVerdict, undefined);
+  assert.equal(row.landedCommit, headAfterMerge, 'HEAD advanced during the run window — landedCommit must be stamped');
+});
+
+test('reapDeadRunningJobs: a worktree job whose branch never diverged from its base (legitimate no-op) still completes, not punished', async () => {
+  const projectCwd = path.join(tmpHome, 'k-project-noop-worktree');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  const headBefore = git(['rev-parse', 'HEAD'], projectCwd).trim();
+  const slug = 'noop-worktree-job';
+  const branch = `sm-job/${slug}`;
+  // Branch created but nothing ever committed on it — a genuine no-op run.
+  git(['branch', branch], projectCwd);
+
+  const runId = `run-${slug}`;
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug,
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 },
+      guardHeadBefore: headBefore,
+      startedAt: new Date(Date.now() - 60_000).toISOString(),
+    },
+  ]);
+  writeRunLog(runId, slug, ['{"type":"result","subtype":"success","result":"done","is_error":false}']);
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === slug);
+  assert.equal(row.status, 'completed', 'a branch with no new commits is a legitimate no-op, not a finish-protocol violation');
+  assert.equal(row.verifierVerdict, undefined);
+  assert.equal(row.landedCommit, undefined, 'HEAD never moved — nothing to stamp');
+});
+
+test('reapDeadRunningJobs: an in-place run in a git repo whose HEAD genuinely advanced during the run window completes, with landedCommit stamped', async () => {
+  const projectCwd = path.join(tmpHome, 'l-project-inplace-success');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  const headBefore = git(['rev-parse', 'HEAD'], projectCwd).trim();
+  const startedAt = new Date(Date.now() - 60_000).toISOString();
+  fs.writeFileSync(path.join(projectCwd, 'shipped.txt'), 'done\n', 'utf8');
+  git(['add', '-A'], projectCwd);
+  git(['commit', '-q', '-m', 'in-place job commit'], projectCwd);
+  const headAfter = git(['rev-parse', 'HEAD'], projectCwd).trim();
+
+  const slug = 'inplace-job-real-commit';
+  const runId = `run-${slug}`;
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug,
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 },
+      guardHeadBefore: headBefore,
+      startedAt,
+    },
+  ]);
+  writeRunLog(runId, slug, ['{"type":"result","subtype":"success","result":"done","is_error":false}']);
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === slug);
+  assert.equal(row.status, 'completed');
+  assert.equal(row.verifierVerdict, undefined);
+  assert.equal(row.landedCommit, headAfter);
+});
+
+test('reapDeadRunningJobs: a non-git cwd skips the integration check entirely, preserving today\'s behaviour', async () => {
+  const projectCwd = path.join(tmpHome, 'm-project-non-git');
+  fs.mkdirSync(projectCwd, { recursive: true });
+  registerActiveProject(projectCwd);
+
+  const slug = 'non-git-cwd-job';
+  const runId = `run-${slug}`;
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug,
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 },
+      // No git repo at all — the integration/HEAD-advance check must be
+      // skipped, never treated as a failure to prove landing.
+    },
+  ]);
+  writeRunLog(runId, slug, ['{"type":"result","subtype":"success","result":"done","is_error":false}']);
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === slug);
+  assert.equal(row.status, 'completed', 'a non-git cwd must keep today\'s behaviour — the check is meaningless there');
+  assert.equal(row.verifierVerdict, undefined);
+});